Every published advisory, newest first. Use search to filter by vendor, industry, country or severity.
On 2026-09-25, CISA added CVE-2026-65660 (Microsoft SharePoint) to its Known Exploited Vulnerabilities (KEV) catalog .
Crypto exchange Bitget confirmed that, based on the latest on-chain tracing, about $387.
According to iThome, on September 23, listed fitness service company Power Wind Health Industry (8462) issued a material announcement on the Market Observation Post System (MOPS), stating that an outsourced system vendor notified the company of an automated attack against its external service system in which hackers attempted paginated scraping of customer database tables, partially involving personal data of Power Wind employees and members .
According to iThome, on September 18, networking equipment manufacturer D-Link (2332) issued a material announcement on the Market Observation Post System (MOPS), stating that its website monitoring mechanisms detected abnormal login records, and further investigation confirmed that external attackers used existing login mechanisms to perform high-volume credential validation attempts against the website .
On 2026-09-22, CISA added CVE-2026-93616 (Check Point Multiple Products) to its Known Exploited Vulnerabilities (KEV) catalog .
On 2026-09-22, CISA added CVE-2026-85102 (Check Point Multiple Products) to its Known Exploited Vulnerabilities (KEV) catalog .
According to TNW, DriveWealth, the US broker behind US stock trading in Revolut and other apps, said an unauthorized party entered its network on September 4 and 5 through social engineering, and platforms such as Stake and Hatch have notified customers .
LMU Munich notified under GDPR Article 34 on September 19 that an unauthorized actor accessed student registration data stored in an IT system and that it must assume the data were retrieved .
According to manager magazin, Revolut answered a fraudulent information request sent from a legitimate government agency email domain, handing ID copies, account numbers and home addresses of at least 700 customers to criminals, who are now demanding ransom .
Japan's Helpfeel said on September 16 that a third party exploited a vulnerability in the image upload server of its screenshot-sharing service Gyazo on September 11 to run arbitrary commands, then accessed the database and exfiltrated user data and image metadata .
According to iThome, on the evening of September 15, Evergreen Group airline EVA Air (2618) and aircraft maintenance and manufacturing company Evergreen Aviation Technologies (EGAT, 2645) issued cybersecurity material announcements on the Market Observation Post System (MOPS), stating that their internal network environments were breached and that cybersecurity incident response mechanisms had been activated .
On 2026-09-16, CISA added CVE-2026-76460 (Cisco Identity Services Engine) to its Known Exploited Vulnerabilities (KEV) catalog .
The UK NCSC with US and Dutch partners issued a joint advisory exposing Iranian state actors using spyware dubbed CHOSEN BRICK against dissidents, activists and journalists worldwide, including in the UK, perceived as a threat to Iran .
According to iThome, on the afternoon of September 14, electronics manufacturing services (EMS) and mechanical integration solutions provider Weibao Precision Technology (7744) issued a material announcement on the Market Observation Post System (MOPS), stating that its information systems were breached, resulting in data on certain systems being encrypted and locked; the company immediately activated its cybersecurity incident response mechanism, disconnected networks, isolated affected systems, convened an emergency response team led by the general manager, and engaged an external cybersecurity team to assist with investigation and recovery .
Ace & Tate said logistics partner CEVA Logistics told it on August 1, 2026 that an unauthorized party accessed systems used to process its orders, and on September 10 CEVA confirmed customer data had been viewed and copied .
US utility CenterPoint Energy said in a September SEC 8-K that after learning of an online post claiming to hold its customer data, it investigated and determined an unauthorized third party obtained personal information of a portion of customers through one of its external-facing systems .
On 2026-09-14, CISA added CVE-2026-76461 (Cisco Secure Email Gateway) to its Known Exploited Vulnerabilities (KEV) catalog .
Japan's Digital Agency said on September 11 that its Government Solution Service (GSS) was accessed without authorization: on June 25 it detected mass file access using a maintenance account, and on July 9 confirmed a third party had entered through a VPN device vulnerability .
According to iThome, DR.
On 2026-09-11, CISA added CVE-2026-85706 (GitLab Community Edition and Enterprise Edition) to its Known Exploited Vulnerabilities (KEV) catalog .